Executive brief
ImageMagick is a widely used software suite for editing and converting digital images. A flaw in its YUV image decoder can cause the software to leak memory when it fails to open certain files. If an attacker repeatedly triggers this leak, it can exhaust the system's available memory, potentially leading to a service outage or application crash.
Technical details
A memory leak vulnerability (CWE-401) exists in the YUV decoder of ImageMagick. The issue is triggered when the decoder fails to open a blob, resulting in allocated memory not being properly released. While the attack complexity is high, a remote attacker can exploit this over a network without authentication or user interaction. Repeated exploitation can lead to resource exhaustion and a denial of service (DoS) condition. The vulnerability is addressed in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date